Your message dated Wed, 15 Nov 2006 17:02:17 -0800
with message-id <[EMAIL PROTECTED]>
and subject line Bug#396949: fixed in lynx-cur 2.8.7dev4-1
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--- Begin Message ---
Package: lynx-cur
Version: 2.8.7dev1-1
Severity: grave
Tags: security
Justification: user security hole
Lynx attempts to use the .mime.types and .mailcap files located in the
current directory:
$ strace lynx -dump 2>&1 | grep '^open("[^/]'
open(".mailcap", O_RDONLY) = -1 ENOENT (No such file or directory)
open(".mime.types", O_RDONLY) = -1 ENOENT (No such file or directory)
$
This allows an attacker to cause lynx to execute arbitrary shell code when a
user runs lynx while visiting a directory with attacker-provided contents.
-- System Information:
Debian Release: testing/unstable
APT prefers testing
APT policy: (500, 'testing')
Architecture: i386 (x86_64)
Shell: /bin/sh linked to /bin/dash
Kernel: Linux 2.6.18
Locale: LANG=C, LC_CTYPE=pl_PL.UTF-8 (charmap=UTF-8)
Versions of packages lynx-cur depends on:
ii debconf [debconf-2.0] 1.5.8 Debian configuration management sy
ii libc6 2.3.6.ds1-4 GNU C Library: Shared libraries
ii libgnutls13 1.4.4-1 the GNU TLS library - runtime libr
ii libncursesw5 5.5-5 Shared libraries for terminal hand
ii zlib1g 1:1.2.3-13 compression library - runtime
Versions of packages lynx-cur recommends:
ii mime-support 3.37-1 MIME files 'mime.types' & 'mailcap
-- debconf information:
* lynx-cur/defaulturl: http://www.google.pl/
lynx-cur/etc_lynx.cfg:
--- End Message ---
--- Begin Message ---
Source: lynx-cur
Source-Version: 2.8.7dev4-1
We believe that the bug you reported is fixed in the latest version of
lynx-cur, which is due to be installed in the Debian FTP archive:
lynx-cur-wrapper_2.8.7dev4-1_all.deb
to pool/main/l/lynx-cur/lynx-cur-wrapper_2.8.7dev4-1_all.deb
lynx-cur_2.8.7dev4-1.diff.gz
to pool/main/l/lynx-cur/lynx-cur_2.8.7dev4-1.diff.gz
lynx-cur_2.8.7dev4-1.dsc
to pool/main/l/lynx-cur/lynx-cur_2.8.7dev4-1.dsc
lynx-cur_2.8.7dev4-1_i386.deb
to pool/main/l/lynx-cur/lynx-cur_2.8.7dev4-1_i386.deb
lynx-cur_2.8.7dev4.orig.tar.gz
to pool/main/l/lynx-cur/lynx-cur_2.8.7dev4.orig.tar.gz
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Atsuhito KOHDA <[EMAIL PROTECTED]> (supplier of updated lynx-cur package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Thu, 16 Nov 2006 08:39:02 +0900
Source: lynx-cur
Binary: lynx-cur-wrapper lynx-cur
Architecture: source i386 all
Version: 2.8.7dev4-1
Distribution: unstable
Urgency: low
Maintainer: Atsuhito KOHDA <[EMAIL PROTECTED]>
Changed-By: Atsuhito KOHDA <[EMAIL PROTECTED]>
Description:
lynx-cur - Text-mode WWW Browser with NLS support (development version)
lynx-cur-wrapper - Wrapper for lynx-cur
Closes: 396949
Changes:
lynx-cur (2.8.7dev4-1) unstable; urgency=low
.
* New Upstream Release. This version fixed the following (Closes: #396949)
* Updated patch-1, patch-2 for this version.
Files:
157422ca711486bab12dbfe9758fdfcf 672 web extra lynx-cur_2.8.7dev4-1.dsc
e4c401080b3bd11522f613b01603152f 3189238 web extra
lynx-cur_2.8.7dev4.orig.tar.gz
fd95f23fee683a9773d78949b812b9ee 24718 web extra lynx-cur_2.8.7dev4-1.diff.gz
66baf1eca4d478db28770967e870b6f2 14574 web extra
lynx-cur-wrapper_2.8.7dev4-1_all.deb
794733c7591e0eff82a0036c9a1ea096 1965836 web extra
lynx-cur_2.8.7dev4-1_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
iD8DBQFFW7Z81IXdL1v6kOwRAj4TAJ4yoV9xXW4Gb8hRSONG5ISCUw2S+wCfdSef
2jk5Io8xcjgBffflQRg12Zg=
=ptQ8
-----END PGP SIGNATURE-----
--- End Message ---
